mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-20 13:39:27 +00:00
Marius CiepluchandClaude Opus 4.8
04667c815e
Ran ousast scan --mode deep on the 5 app-shaped + sound pool targets (the fair change-scoped eval set from the shape classification). Detection 3/5: graphiti (hunter, Cypher injection), mcp-remote (hunter, url-scheme injection), dcmcp (ENGINE overlay -- 'outbound.request reached from parameter' on readFileFromUrl; parameter-as-source fired because an entry point is present). 2/5 missed: malla (DOM/template XSS) and dms (Jinja SSTI), both in families families.toml documents as limited. This validates the strategic pivot: the near-zero catch was substantially a TARGET MISMATCH -- on app-shaped repos the engine itself detects (0 -> 3/5). But all hits stop at suspicion/ static_corroboration; release-grade BLOCK still needs proof-arm elevation + family coverage + the DSPy hint loop. Cost ~$0.007/repo. So bet #1 (fix eval target) is necessary and material but not sufficient. Next: recompute a floor on an app-shaped sound subset / real app corpus (VAmPI, NodeGoat, DjanGoat, vibe-py); measure proof-arm suspicion->proven lift. Co-Authored-By: Claude Opus 4.8 <[email protected]>
1294 lines
48 KiB
JSON
1294 lines
48 KiB
JSON
{
|
|
"findings": [
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "python-sql-injection:src/malla/database/repositories.py:52",
|
|
"function_name": null,
|
|
"line": 52,
|
|
"path": "src/malla/database/repositories.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 4.3,
|
|
"rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 52; manual verification still required.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [
|
|
{
|
|
"access_declared": false,
|
|
"access_evidence": [
|
|
"network entry file tag"
|
|
],
|
|
"access_level": "public",
|
|
"conditions": [],
|
|
"defines_handler": true,
|
|
"end_line": null,
|
|
"function_name": null,
|
|
"kind": "route",
|
|
"line": null,
|
|
"name": "network_surface",
|
|
"path": "src/malla/database/repositories.py",
|
|
"provenance": "entrypoint:route:public",
|
|
"rationale": "route surface classified as public at network_request",
|
|
"registered_by": "",
|
|
"trust_boundary": "network_request"
|
|
},
|
|
{
|
|
"access_declared": false,
|
|
"access_evidence": [
|
|
"parser/deserialization file tag"
|
|
],
|
|
"access_level": "public",
|
|
"conditions": [],
|
|
"defines_handler": true,
|
|
"end_line": null,
|
|
"function_name": null,
|
|
"kind": "parser",
|
|
"line": null,
|
|
"name": "parser_input",
|
|
"path": "src/malla/database/repositories.py",
|
|
"provenance": "entrypoint:parser:public",
|
|
"rationale": "parser surface classified as public at attacker_controlled_input",
|
|
"registered_by": "",
|
|
"trust_boundary": "attacker_controlled_input"
|
|
}
|
|
],
|
|
"reachability_status": "inferred-file-surface",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"crypto",
|
|
"injection",
|
|
"network_entry",
|
|
"parser"
|
|
],
|
|
"title": "Python SQL string composition needs review"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "python-sql-injection:src/malla/database/repositories.py:73",
|
|
"function_name": null,
|
|
"line": 73,
|
|
"path": "src/malla/database/repositories.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 4.3,
|
|
"rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 73; manual verification still required.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [
|
|
{
|
|
"access_declared": false,
|
|
"access_evidence": [
|
|
"network entry file tag"
|
|
],
|
|
"access_level": "public",
|
|
"conditions": [],
|
|
"defines_handler": true,
|
|
"end_line": null,
|
|
"function_name": null,
|
|
"kind": "route",
|
|
"line": null,
|
|
"name": "network_surface",
|
|
"path": "src/malla/database/repositories.py",
|
|
"provenance": "entrypoint:route:public",
|
|
"rationale": "route surface classified as public at network_request",
|
|
"registered_by": "",
|
|
"trust_boundary": "network_request"
|
|
},
|
|
{
|
|
"access_declared": false,
|
|
"access_evidence": [
|
|
"parser/deserialization file tag"
|
|
],
|
|
"access_level": "public",
|
|
"conditions": [],
|
|
"defines_handler": true,
|
|
"end_line": null,
|
|
"function_name": null,
|
|
"kind": "parser",
|
|
"line": null,
|
|
"name": "parser_input",
|
|
"path": "src/malla/database/repositories.py",
|
|
"provenance": "entrypoint:parser:public",
|
|
"rationale": "parser surface classified as public at attacker_controlled_input",
|
|
"registered_by": "",
|
|
"trust_boundary": "attacker_controlled_input"
|
|
}
|
|
],
|
|
"reachability_status": "inferred-file-surface",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"crypto",
|
|
"injection",
|
|
"network_entry",
|
|
"parser"
|
|
],
|
|
"title": "Python SQL string composition needs review"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "python-sql-injection:src/malla/database/repositories.py:80",
|
|
"function_name": null,
|
|
"line": 80,
|
|
"path": "src/malla/database/repositories.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 4.3,
|
|
"rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 80; manual verification still required.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [
|
|
{
|
|
"access_declared": false,
|
|
"access_evidence": [
|
|
"network entry file tag"
|
|
],
|
|
"access_level": "public",
|
|
"conditions": [],
|
|
"defines_handler": true,
|
|
"end_line": null,
|
|
"function_name": null,
|
|
"kind": "route",
|
|
"line": null,
|
|
"name": "network_surface",
|
|
"path": "src/malla/database/repositories.py",
|
|
"provenance": "entrypoint:route:public",
|
|
"rationale": "route surface classified as public at network_request",
|
|
"registered_by": "",
|
|
"trust_boundary": "network_request"
|
|
},
|
|
{
|
|
"access_declared": false,
|
|
"access_evidence": [
|
|
"parser/deserialization file tag"
|
|
],
|
|
"access_level": "public",
|
|
"conditions": [],
|
|
"defines_handler": true,
|
|
"end_line": null,
|
|
"function_name": null,
|
|
"kind": "parser",
|
|
"line": null,
|
|
"name": "parser_input",
|
|
"path": "src/malla/database/repositories.py",
|
|
"provenance": "entrypoint:parser:public",
|
|
"rationale": "parser surface classified as public at attacker_controlled_input",
|
|
"registered_by": "",
|
|
"trust_boundary": "attacker_controlled_input"
|
|
}
|
|
],
|
|
"reachability_status": "inferred-file-surface",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"crypto",
|
|
"injection",
|
|
"network_entry",
|
|
"parser"
|
|
],
|
|
"title": "Python SQL string composition needs review"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "python-sql-injection:src/malla/database/repositories.py:3024",
|
|
"function_name": null,
|
|
"line": 3024,
|
|
"path": "src/malla/database/repositories.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 4.3,
|
|
"rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 3024; manual verification still required.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [
|
|
{
|
|
"access_declared": false,
|
|
"access_evidence": [
|
|
"network entry file tag"
|
|
],
|
|
"access_level": "public",
|
|
"conditions": [],
|
|
"defines_handler": true,
|
|
"end_line": null,
|
|
"function_name": null,
|
|
"kind": "route",
|
|
"line": null,
|
|
"name": "network_surface",
|
|
"path": "src/malla/database/repositories.py",
|
|
"provenance": "entrypoint:route:public",
|
|
"rationale": "route surface classified as public at network_request",
|
|
"registered_by": "",
|
|
"trust_boundary": "network_request"
|
|
},
|
|
{
|
|
"access_declared": false,
|
|
"access_evidence": [
|
|
"parser/deserialization file tag"
|
|
],
|
|
"access_level": "public",
|
|
"conditions": [],
|
|
"defines_handler": true,
|
|
"end_line": null,
|
|
"function_name": null,
|
|
"kind": "parser",
|
|
"line": null,
|
|
"name": "parser_input",
|
|
"path": "src/malla/database/repositories.py",
|
|
"provenance": "entrypoint:parser:public",
|
|
"rationale": "parser surface classified as public at attacker_controlled_input",
|
|
"registered_by": "",
|
|
"trust_boundary": "attacker_controlled_input"
|
|
}
|
|
],
|
|
"reachability_status": "inferred-file-surface",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"crypto",
|
|
"injection",
|
|
"network_entry",
|
|
"parser"
|
|
],
|
|
"title": "Python SQL string composition needs review"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "python-sql-injection:src/malla/mqtt_capture.py:344",
|
|
"function_name": null,
|
|
"line": 344,
|
|
"path": "src/malla/mqtt_capture.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 1.5,
|
|
"rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 344; manual verification still required.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"auth_boundary",
|
|
"crypto",
|
|
"injection",
|
|
"network_entry",
|
|
"parser"
|
|
],
|
|
"title": "Python SQL string composition needs review"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "python-sql-injection:src/malla/services/analytics_service.py:182",
|
|
"function_name": null,
|
|
"line": 182,
|
|
"path": "src/malla/services/analytics_service.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 1.0,
|
|
"rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 182; manual verification still required.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"injection"
|
|
],
|
|
"title": "Python SQL string composition needs review"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "python-sql-injection:src/malla/services/analytics_service.py:250",
|
|
"function_name": null,
|
|
"line": 250,
|
|
"path": "src/malla/services/analytics_service.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 1.0,
|
|
"rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 250; manual verification still required.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"injection"
|
|
],
|
|
"title": "Python SQL string composition needs review"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "python-sql-injection:src/malla/services/analytics_service.py:443",
|
|
"function_name": null,
|
|
"line": 443,
|
|
"path": "src/malla/services/analytics_service.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 1.0,
|
|
"rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 443; manual verification still required.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"injection"
|
|
],
|
|
"title": "Python SQL string composition needs review"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "python-sql-injection:src/malla/services/analytics_service.py:493",
|
|
"function_name": null,
|
|
"line": 493,
|
|
"path": "src/malla/services/analytics_service.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 1.0,
|
|
"rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 493; manual verification still required.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"injection"
|
|
],
|
|
"title": "Python SQL string composition needs review"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "python-sql-injection:src/malla/services/gateway_service.py:205",
|
|
"function_name": null,
|
|
"line": 205,
|
|
"path": "src/malla/services/gateway_service.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 1.0,
|
|
"rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 205; manual verification still required.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"injection"
|
|
],
|
|
"title": "Python SQL string composition needs review"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "python-sql-injection:src/malla/utils/node_utils.py:225",
|
|
"function_name": null,
|
|
"line": 225,
|
|
"path": "src/malla/utils/node_utils.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 1.0,
|
|
"rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 225; manual verification still required.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"injection"
|
|
],
|
|
"title": "Python SQL string composition needs review"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "python-sql-injection:src/malla/utils/node_utils.py:305",
|
|
"function_name": null,
|
|
"line": 305,
|
|
"path": "src/malla/utils/node_utils.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 1.0,
|
|
"rationale": "Static pattern python-sql-injection (CWE-89) matched .execute on line 305; manual verification still required.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"injection"
|
|
],
|
|
"title": "Python SQL string composition needs review"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "python-ssti:tests/conftest/test_server.py:97",
|
|
"function_name": null,
|
|
"line": 97,
|
|
"path": "tests/conftest/test_server.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 1.5,
|
|
"rationale": "Static pattern python-ssti (CWE-94) matched render_template_string on line 97; manual verification still required.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"auth_boundary",
|
|
"filesystem_entry",
|
|
"injection",
|
|
"network_entry"
|
|
],
|
|
"title": "Python server-side template injection needs review"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:run_tests.py:19:os.system",
|
|
"function_name": null,
|
|
"line": 19,
|
|
"path": "run_tests.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink os.system reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "critical",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: os.system"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/database/packet_repository_optimized.py:144:execute",
|
|
"function_name": null,
|
|
"line": 144,
|
|
"path": "src/malla/database/packet_repository_optimized.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink execute reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: execute"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/database/packet_repository_optimized.py:316:execute",
|
|
"function_name": null,
|
|
"line": 316,
|
|
"path": "src/malla/database/packet_repository_optimized.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink execute reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: execute"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/database/repositories.py:301:execute",
|
|
"function_name": null,
|
|
"line": 301,
|
|
"path": "src/malla/database/repositories.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink execute reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: execute"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/database/repositories.py:536:execute",
|
|
"function_name": null,
|
|
"line": 536,
|
|
"path": "src/malla/database/repositories.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink execute reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: execute"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/database/repositories.py:790:execute",
|
|
"function_name": null,
|
|
"line": 790,
|
|
"path": "src/malla/database/repositories.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink execute reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: execute"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/database/repositories.py:1089:execute",
|
|
"function_name": null,
|
|
"line": 1089,
|
|
"path": "src/malla/database/repositories.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink execute reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: execute"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/database/repositories.py:2133:execute",
|
|
"function_name": null,
|
|
"line": 2133,
|
|
"path": "src/malla/database/repositories.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink execute reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: execute"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/database/repositories.py:2739:execute",
|
|
"function_name": null,
|
|
"line": 2739,
|
|
"path": "src/malla/database/repositories.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink execute reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: execute"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/database/repositories.py:3059:execute",
|
|
"function_name": null,
|
|
"line": 3059,
|
|
"path": "src/malla/database/repositories.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink execute reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: execute"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/services/analytics_service.py:139:execute",
|
|
"function_name": null,
|
|
"line": 139,
|
|
"path": "src/malla/services/analytics_service.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink execute reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: execute"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/services/analytics_service.py:343:execute",
|
|
"function_name": null,
|
|
"line": 343,
|
|
"path": "src/malla/services/analytics_service.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink execute reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: execute"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/static/js/direct_receptions.js:73:outbound.request",
|
|
"function_name": null,
|
|
"line": 73,
|
|
"path": "src/malla/static/js/direct_receptions.js",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink outbound.request reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: outbound.request"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/static/js/node-cache.js:117:outbound.request",
|
|
"function_name": null,
|
|
"line": 117,
|
|
"path": "src/malla/static/js/node-cache.js",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink outbound.request reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: outbound.request"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/static/js/node-picker.js:581:outbound.request",
|
|
"function_name": null,
|
|
"line": 581,
|
|
"path": "src/malla/static/js/node-picker.js",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink outbound.request reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: outbound.request"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/static/js/url-filter-manager.js:41:prototype.merge",
|
|
"function_name": null,
|
|
"line": 41,
|
|
"path": "src/malla/static/js/url-filter-manager.js",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink prototype.merge reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "info",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: prototype.merge"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/static/js/url-filter-manager.js:110:outbound.request",
|
|
"function_name": null,
|
|
"line": 110,
|
|
"path": "src/malla/static/js/url-filter-manager.js",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink outbound.request reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: outbound.request"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/static/js/url-filter-manager.js:171:outbound.request",
|
|
"function_name": null,
|
|
"line": 171,
|
|
"path": "src/malla/static/js/url-filter-manager.js",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink outbound.request reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: outbound.request"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/static/js/url-filter-manager.js:183:outbound.request",
|
|
"function_name": null,
|
|
"line": 183,
|
|
"path": "src/malla/static/js/url-filter-manager.js",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink outbound.request reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: outbound.request"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/static/js/url-filter-manager.js:279:prototype.merge",
|
|
"function_name": null,
|
|
"line": 279,
|
|
"path": "src/malla/static/js/url-filter-manager.js",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink prototype.merge reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "info",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: prototype.merge"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:src/malla/web_ui.py:207:html.unescaped",
|
|
"function_name": null,
|
|
"line": 207,
|
|
"path": "src/malla/web_ui.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink html.unescaped reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: html.unescaped"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:tests/conftest.py:119:path.open",
|
|
"function_name": null,
|
|
"line": 119,
|
|
"path": "tests/conftest.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink path.open reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: path.open"
|
|
},
|
|
{
|
|
"confidence": "medium",
|
|
"evidence_level": "static_corroboration",
|
|
"finding_id": "overlay-coverage:tests/conftest/test_server.py:67:path.open",
|
|
"function_name": null,
|
|
"line": 67,
|
|
"path": "tests/conftest/test_server.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "uninventoried sink path.open reached from parameter",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"overlay-originated"
|
|
],
|
|
"title": "Overlay coverage: path.open"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "obligation:protected_read:src/malla/routes/api_routes.py:217:identity_constraint",
|
|
"function_name": "api_nodes",
|
|
"line": 217,
|
|
"path": "src/malla/routes/api_routes.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.3,
|
|
"rationale": "protected_read on a resource in api_nodes is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"obligation:protected_read",
|
|
"discharger:identity_constraint",
|
|
"obligation_evidence:function_local"
|
|
],
|
|
"title": "Obligation not discharged: protected_read on a resource without identity_constraint"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "obligation:protected_read:src/malla/routes/api_routes.py:267:identity_constraint",
|
|
"function_name": "api_nodes_search",
|
|
"line": 267,
|
|
"path": "src/malla/routes/api_routes.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.3,
|
|
"rationale": "protected_read on a resource in api_nodes_search is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"obligation:protected_read",
|
|
"discharger:identity_constraint",
|
|
"obligation_evidence:function_local"
|
|
],
|
|
"title": "Obligation not discharged: protected_read on a resource without identity_constraint"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "obligation:protected_read:src/malla/routes/api_routes.py:374:identity_constraint",
|
|
"function_name": "api_gateways_search",
|
|
"line": 374,
|
|
"path": "src/malla/routes/api_routes.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.3,
|
|
"rationale": "protected_read on a resource in api_gateways_search is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"obligation:protected_read",
|
|
"discharger:identity_constraint",
|
|
"obligation_evidence:function_local"
|
|
],
|
|
"title": "Obligation not discharged: protected_read on a resource without identity_constraint"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "obligation:protected_read:src/malla/routes/api_routes.py:386:identity_constraint",
|
|
"function_name": "api_gateways_search",
|
|
"line": 386,
|
|
"path": "src/malla/routes/api_routes.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.3,
|
|
"rationale": "protected_read on a resource in api_gateways_search is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"obligation:protected_read",
|
|
"discharger:identity_constraint",
|
|
"obligation_evidence:function_local"
|
|
],
|
|
"title": "Obligation not discharged: protected_read on a resource without identity_constraint"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "obligation:protected_read:src/malla/routes/api_routes.py:895:identity_constraint",
|
|
"function_name": "api_traceroute_hops_nodes",
|
|
"line": 895,
|
|
"path": "src/malla/routes/api_routes.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.3,
|
|
"rationale": "protected_read on a resource in api_traceroute_hops_nodes is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"obligation:protected_read",
|
|
"discharger:identity_constraint",
|
|
"obligation_evidence:function_local"
|
|
],
|
|
"title": "Obligation not discharged: protected_read on a resource without identity_constraint"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "obligation:protected_read:src/malla/routes/api_routes.py:896:identity_constraint",
|
|
"function_name": "api_traceroute_hops_nodes",
|
|
"line": 896,
|
|
"path": "src/malla/routes/api_routes.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.3,
|
|
"rationale": "protected_read on a resource in api_traceroute_hops_nodes is reached without a dominating identity_constraint. Why the obligation exists: the operation fact alone (function-local mode). Label: function_local.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "high",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"obligation:protected_read",
|
|
"discharger:identity_constraint",
|
|
"obligation_evidence:function_local"
|
|
],
|
|
"title": "Obligation not discharged: protected_read on a resource without identity_constraint"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "tool-hunter:src/malla/config.py:88",
|
|
"function_name": null,
|
|
"line": 88,
|
|
"path": "src/malla/config.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "Comment at line 88 states 'Basic builtin types are fine to eval() in this restricted context.' eval() on configuration-derived strings is a code-execution sink if the config file or environment can be influenced. Confirmed the eval usage exists; the exact coercion scope was not fully read.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"tool-hunter",
|
|
"family:code_execution"
|
|
],
|
|
"title": "eval() used for config value coercion"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "tool-hunter:src/malla/database/packet_repository_optimized.py:311",
|
|
"function_name": null,
|
|
"line": 311,
|
|
"path": "src/malla/database/packet_repository_optimized.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 0.0,
|
|
"rationale": "Same pattern as repositories.py: order_by: str = \"timestamp\" (line 23) is interpolated into f\"... ORDER BY {order_by} {order_dir.upper()}\" (line 311), with where_clause also f-string built (lines 100-139, 295, 310). Identifier-position interpolation is injection-prone unless callers enforce an allowlist.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"tool-hunter",
|
|
"family:sql_injection"
|
|
],
|
|
"title": "order_by/order_dir interpolated into SQL ORDER BY clause"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "tool-hunter:src/malla/database/repositories.py:152",
|
|
"function_name": null,
|
|
"line": 152,
|
|
"path": "src/malla/database/repositories.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 18.7715,
|
|
"rationale": "get_packets accepts order_by: str = \"timestamp\" and the query is built with f-string interpolation ({where_clause} and ORDER BY {order_by} {order_dir.upper()} at line 296 area). If order_by/order_dir reach this from request args without an allowlist, this is SQL injection via identifier position. Confirmed the f-string query construction exists in this file; the caller-side validation was not established by the tools.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"tool-hunter",
|
|
"family:sql_injection"
|
|
],
|
|
"title": "order_by parameter interpolated into SQL ORDER BY clause"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "tool-hunter:src/malla/database/repositories.py:53",
|
|
"function_name": null,
|
|
"line": 53,
|
|
"path": "src/malla/database/repositories.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 18.7715,
|
|
"rationale": "get_stats builds gateway_filter = \" AND gateway_id = ?\" and interpolates it into an f-string query (lines 53, 74, 81). The fragment itself is a constant with a bound parameter, so this is low risk, but it is the same f-string SQL construction pattern flagged across the file and worth confirming no caller-controlled fragment is ever substituted.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"tool-hunter",
|
|
"family:sql_injection"
|
|
],
|
|
"title": "f-string SQL with gateway_filter fragment in DashboardRepository.get_stats"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "tool-hunter:src/malla/mqtt_capture.py:157",
|
|
"function_name": null,
|
|
"line": 157,
|
|
"path": "src/malla/mqtt_capture.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 17.2018,
|
|
"rationale": "decrypt_packet constructs a Cipher (line 157) and decrypts attacker-reachable MQTT payloads (try_decrypt_mesh_packet, line 175; called from the capture loop around line 1063). Decrypted bytes are then ParseFromString'd as protobuf (line 241). This is the crypto/network_entry/parser hotspot; the decryption path handles untrusted input and feeds a protobuf parser.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"tool-hunter",
|
|
"family:crypto"
|
|
],
|
|
"title": "AES decryption of network-received MQTT payloads"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "tool-hunter:src/malla/mqtt_capture.py:241",
|
|
"function_name": null,
|
|
"line": 241,
|
|
"path": "src/malla/mqtt_capture.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 17.2018,
|
|
"rationale": "decoded_data.ParseFromString(decrypted_payload) parses bytes derived from network MQTT traffic after decryption. Protobuf parsing of untrusted input is the parser sink in this high-complexity module; malformed input is caught (parse_error handling at line 260) but the parse itself operates on attacker-influenced bytes.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"tool-hunter",
|
|
"family:parser"
|
|
],
|
|
"title": "Protobuf ParseFromString on decrypted network payload"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "tool-hunter:src/malla/routes/api_routes.py:88",
|
|
"function_name": null,
|
|
"line": 88,
|
|
"path": "src/malla/routes/api_routes.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 16.79,
|
|
"rationale": "api_analytics (line 88) reads gateway_id, from_node, hop_count from request.args and forwards to AnalyticsService.get_analytics_data. api_packets (line 111) similarly builds filters from request args. These are the network_entry points feeding the repository query builders flagged above; whether the args reach order_by/where fragments was not established by the tools.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"tool-hunter",
|
|
"family:sql_injection"
|
|
],
|
|
"title": "api_analytics route passes request args into service layer"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "tool-hunter:src/malla/routes/packet_routes.py:1369",
|
|
"function_name": null,
|
|
"line": 1369,
|
|
"path": "src/malla/routes/packet_routes.py",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 17.7787,
|
|
"rationale": "packet_detail (line 1369) and packets (line 1347) are the flagged high-band functions in this 1202-LOC module. get_packet_details (line 24) executes parameterized SQL (WHERE id = ?, line 41) which is safe, but the route layer builds filters and calls repositories; the complexity/nesting (10) makes filter-construction paths worth auditing for identifier interpolation. Confirmed the route definitions and the parameterized query.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"tool-hunter",
|
|
"family:sql_injection"
|
|
],
|
|
"title": "packet_detail route with high nesting and DB access"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "tool-hunter:src/malla/static/js/location-cache.js:18",
|
|
"function_name": null,
|
|
"line": 18,
|
|
"path": "src/malla/static/js/location-cache.js",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 18.0874,
|
|
"rationale": "location-cache.js parses localStorage (JSON.parse(raw), line 18) and returns parsed.locations, used for map/coordinate rendering. Same untrusted-storage deserialization pattern as node-cache.js; no validation of the parsed object shape beyond a typeof check.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"tool-hunter",
|
|
"family:untrusted_deserialization"
|
|
],
|
|
"title": "JSON.parse of localStorage cache without schema validation"
|
|
},
|
|
{
|
|
"confidence": "low",
|
|
"evidence_level": "suspicion",
|
|
"finding_id": "tool-hunter:src/malla/static/js/node-cache.js:19",
|
|
"function_name": null,
|
|
"line": 19,
|
|
"path": "src/malla/static/js/node-cache.js",
|
|
"proposed_snippet": null,
|
|
"ranking_priority": 18.2639,
|
|
"rationale": "node-cache.js parses localStorage (JSON.parse(raw), line 19) and returns parsed.nodes, which is then used by getNode/search and rendered elsewhere. localStorage is attacker-writable in XSS scenarios; the parsed node objects flow into UI rendering (innerHTML usage exists in sibling files like node-picker.js/modern-table.js). Deserialization of untrusted storage without validation.",
|
|
"reachability_conditions": [],
|
|
"reachability_evidence": [],
|
|
"reachability_status": "unknown",
|
|
"rung": "suspicion",
|
|
"severity": "medium",
|
|
"status": "enabled",
|
|
"tags": [
|
|
"tool-hunter",
|
|
"family:untrusted_deserialization"
|
|
],
|
|
"title": "JSON.parse of localStorage cache without schema validation"
|
|
}
|
|
]
|
|
}
|